registry / dolyame-boxy-fonts / 35.4.8

dolyame-boxy-fonts@35.4.8

Reusable dolyame boxy fonts components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically activates a remote payload loader. It downloads an opaque executable, writes it to temporary storage, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary code execution under the importing process user.

Mechanism

Remote binary download, DNS fallback, temporary-file staging, and detached execution.

Attack narrative

The public entrypoint silently requires _loader.js. On import, it retrieves an opaque platform payload from rotating HTTPS hosts or DNS TXT records, writes it under a random temporary filename, marks it executable on Unix, and starts it detached through a shell or cmd.exe. The similarly capable telemetry module is not exported by the public entrypoint, but the active loader independently establishes the execution chain.

Rationale

This is a concrete import-time staged-payload execution chain unrelated to the declared fonts functionality. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require() of dolyame-boxy-fonts, index.js unconditionally loads./_loader.js, which reconstructs C2 hostnames from split-string arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and a DNS-TXT fallback channel under *.dl.wel1.ru (chunk-count via c.<domain>, base64 chunks via N.<domain> retrieved through dns.resolveTxt). _loader.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a hidden/decoy name (.cache_<rand> or dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. The fetched bytes are opaque, unpinned, and not hash-verified, and the destination hosts are anonymous Cloudflare Workers subdomains assembled at runtime to defeat static grep. A sibling module lib/telemetry.js ships in the tarball with the same dropper primitives (require('child_' + 'process') string-split, fs['chmod' + 'Sync'], cp.spawn('/bin/sh', ['-c', filePath + ' &'])), providing an alternate execution path. Installing or requiring this package causes attacker-controlled code to execute on the installer's machine.

dolyame-boxy-fonts@35.4.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code